What this protects
Patch compliance, and the cost of standing still
An unsupported server keeps working right up until the day it does not, and by then the choice has already been made for you.
Your licence to operate
Insurers and auditors ask how you patch. A server Microsoft no longer fixes is a difficult answer to give.
A decision deadline you set
The date is published years ahead. Planning early buys options; leaving it late buys whatever is left.
Three-year cost, not the first invoice
New hardware is a capital outlay; the cloud is a monthly cost. Compare the whole picture before deciding.
What end of support actually means
End of support does not switch a server off. On 12 January 2027, Microsoft simply stops issuing security patches for Windows Server 2016. The machine keeps running, the staff keep working, and nothing appears to have changed, which is exactly why it catches businesses out.
From that date, any newly discovered flaw in the operating system goes unfixed. A server that was safe in December is quietly becoming a liability in February, and the risk grows with every month that passes.
Why this is a planning problem, not a panic
The date is already known
Microsoft publishes these dates years in advance. There is no surprise here, only the question of whether anyone put it in the diary.
Unpatched means exposed
Security flaws found after the support window closes stay open. That is the whole risk, stated plainly.
Your hardware is probably old too
A server running 2016 has usually been running it a while. The refresh window and the end-of-life date tend to arrive together.
Compliance takes a dim view
Insurers and auditors increasingly ask how you patch. An unsupported operating system holding business data is a difficult answer.
A chance to fix the shape of it
Replacing a server is rarely just about the server. It is the moment to ask whether you need one at all, or whether the workload suits the cloud.
Doing nothing has a cost
Not spending is not the same as saving. The price of an unsupported server is simply paid later, and usually at a worse time.
The three paths, honestly compared
The first is to replace the server with a newer one and carry on as before. It is familiar, it works, and for some businesses it is genuinely the right answer, particularly where a line-of-business application needs a machine it can call home.
The second is to move the workload to the cloud, into Microsoft 365 and Azure or onto hosted infrastructure. This tends to suit businesses with several sites, hybrid teams, or a wish to stop buying hardware altogether. It is not automatically cheaper, whatever the brochure says. The third is to do nothing and hope, which is the cheapest this year and the most expensive the moment anything goes wrong.
Signs the cloud is the better fit
- Your team already works from home, from other sites, or from a van
- You run your own email server and would happily never think about it again
- Your server exists mainly to hold files and a line-of-business application
- You have no internal IT person and no appetite to acquire one
- You are about to spend money on hardware that would tie you to it for another five years
How to plan the migration without losing a weekend
- Inventory what the server actually does before deciding where it should live
- Group the workloads, because some want the cloud and some are happier where they are
- Test the migration on the least critical application first, not the most
- Agree the cutover window around your quiet period, not your provider's diary
- Decide who supports each piece after the move, and put it in writing
- Keep the old server running until the new arrangement has proved itself
Extended Security Updates are a bridge, not a home
Microsoft will sell Extended Security Updates for Server 2016 after the deadline, which patches the worst of the holes for an annual fee. It is a genuine option for a business that needs more time to plan a move properly.
What it is not is a destination. The price rises each year, it buys you no new capability, and you are paying to stand still on hardware that will still need replacing later. If you use it, treat it as a bridge with an end date of its own.
What to do about it
- Put the 12 January 2027 date in a diary now, with a decision deadline well before it.
- Inventory what the server actually does before choosing a destination for it.
- Treat Extended Security Updates as a bridge with its own end date, not a fix.
- Compare the three-year cost of new hardware against the cloud, not the first invoice.
Questions we get asked about this
What happens if we simply keep running Windows Server 2016 after support ends?
It keeps running, and it keeps working, until a security flaw is found that Microsoft will not fix. You are then carrying an unpatched system holding business data, which is a risk rather than an immediate emergency.
Is moving to the cloud always cheaper than replacing the server?
No, and any provider who says otherwise is selling something. Cloud costs are ongoing and scale with use; hardware is a larger upfront cost that you own for years. The right answer depends on how you work.
How long does a cloud migration take?
A single server moving one or two workloads can be planned and done in a matter of weeks. Larger or more tangled environments take longer, which is exactly why the deadline should be treated as the last date, not the start date.